Техническая информация
Вредоносные функции:
Выполняет код следующих детектируемых угроз:
- Adware.Gexin.2.origin
Осуществляет доступ к приватному интерфейсу ITelephony.
Сетевая активность:
Подключается к:
- UDP(DNS) <Google DNS>
- TCP(HTTP/1.1) e####.h####.com:80
- TCP(HTTP/1.1) vc.m####.com:80
- TCP(HTTP/1.1) ap####.v0.m####.com:80
- TCP(HTTP/1.1) imgal####.res.m####.com:80
- TCP(HTTP/1.1) x.da.m####.com:80
- TCP(HTTP/1.1) v2.log.hun####.com:80
- TCP(HTTP/1.1) 0####.h####.com:80
- TCP(HTTP/1.1) g####.hun####.com:80
- TCP(HTTP/1.1) use####.api.max.####.com:80
- TCP(HTTP/1.1) pl####.log.hun####.com:80
- TCP(HTTP/1.1) ti####.c####.l####.####.com:80
- TCP(HTTP/1.1) st.bz.m####.com:80
- TCP(HTTP/1.1) d####.t####.m####.com:80
- TCP(HTTP/1.1) t####.c####.q####.####.com:80
- TCP(HTTP/1.1) com####.m####.com:80
- TCP(HTTP/1.1) www.qchann####.cn:80
- TCP(HTTP/1.1) log.v2.hun####.com:80
- TCP(HTTP/1.1) hun####.m.cn.####.com:80
- TCP(HTTP/1.1) o####.ar####.api.####.com:80
- TCP(HTTP/1.1) c-h####.g####.com:80
- TCP(HTTP/1.1) log.rc.hun####.com:80
- TCP(HTTP/1.1) vhun####.adma####.com.cn:80
- TCP(HTTP/1.1) 1####.h####.com:80
- TCP(HTTP/1.1) res####.a####.com:80
- TCP(HTTP/1.1) mo####.log.hun####.com:80
- TCP(HTTP/1.1) m####.api.m####.com:80
- TCP(HTTP/1.1) x.da.hun####.com:80
- TCP(HTTP/1.1) a####.u####.com:80
- TCP(HTTP/1.1) qin####.com.www.####.com:80
- TCP(HTTP/1.1) sdk-ope####.g####.com:80
- TCP(HTTP/1.1) mob.bz.m####.com:80
- TCP(HTTP/1.1) log.da.hun####.com:80
- TCP(HTTP/1.1) cou####.pe####.m####.com:80
- TCP(HTTP/1.1) o####.ac####.api.####.com:80
- TCP(HTTP/1.1) y.da.hun####.com:80
- TCP(HTTP/1.1) s5.hun####.com:80
- TCP(TLS/1.0) ad-sh-s####.wagbr####.t####.####.com:443
- TCP(TLS/1.0) qq.i####.com:443
- TCP 43.2####.145.67:5226
- TCP sdk.o####.t####.####.com:5224
- TCP t####.nz4.ig####.com:5224
Запросы DNS:
- 0####.h####.com
- 1####.h####.com
- 2####.h####.com
- 3####.h####.com
- 4####.h####.com
- 7j####.c####.z0.####.com
- a####.u####.com
- ap####.v0.m####.com
- api####.a####.com
- c-h####.g####.com
- com####.m####.com
- cou####.pe####.m####.com
- d####.t####.m####.com
- e####.h####.com
- ef-dong####.t####.com
- g####.hun####.com
- hun####.m.cn.####.com
- imgal####.res.m####.com
- log.da.hun####.com
- log.rc.hun####.com
- log.v2.hun####.com
- m####.api.m####.com
- m.i####.com
- mo####.api.hun####.com
- mo####.log.hun####.com
- mob.bz.m####.com
- o####.ac####.api.####.com
- o####.ar####.api.####.com
- pl####.log.hun####.com
- pub-####.qin####.com
- rc.m####.com
- s5.hun####.com
- sdk-ope####.g####.com
- sdk.c####.ig####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.com
- sdk.o####.t####.####.net
- st.bz.m####.com
- t####.nz4.g####.net
- t####.nz4.ge####.com
- t####.nz4.ig####.com
- use####.api.max.####.com
- v2.log.hun####.com
- v2.res.log.####.com
- vc.m####.com
- vhun####.adma####.com.cn
- www.qchann####.cn
- x.da.hun####.com
- x.da.m####.com
- y.da.hun####.com
Запросы HTTP GET:
- 0####.h####.com/preview/cms_icon/2019/1/6/01/20190106123248013.jpg_130x1...
- 0####.h####.com/preview/cms_icon/2019/2/13/02/20190213221339489.jpg_130x...
- 0####.h####.com/preview/cms_icon/2019/3/1/03/20190301193945379.jpg_130x1...
- 0####.h####.com/preview/cms_icon/2019/3/1/03/20190301223954514.jpg_366x2...
- 0####.h####.com/preview/cms_icon/2019/3/2/03/20190302213625037.jpg_366x2...
- 0####.h####.com/preview/cms_icon/2019/3/3/03/20190303113456950.jpg_366x2...
- 0####.h####.com/preview/cms_icon/2019/3/3/03/20190303155228668.gif
- 0####.h####.com/preview/sp_images/2017/zongyi/310102/3802527/20170129194...
- 0####.h####.com/preview/sp_images/2017/zongyi/310102/3852553/20170305182...
- 0####.h####.com/preview/sp_images/2017/zongyi/314634/4017888/20170717214...
- 0####.h####.com/preview/sp_images/2018/11/16/zongyi/326363/4736228/20181...
- 0####.h####.com/preview/sp_images/2018/11/16/zongyi/326363/4736252/20181...
- 0####.h####.com/preview/sp_images/2018/11/26/zongyi/325275/4763393/20181...
- 0####.h####.com/preview/sp_images/2018/zongyi/320515/4514263/20180817163...
- 0####.h####.com/preview/sp_images/2018/zongyi/322705/4435892/20180619173...
- 0####.h####.com/preview/sp_images/2018/zongyi/323564/4439865/20180622173...
- 0####.h####.com/preview/sp_images/2018/zongyi/323564/4449292/20180701171...
- 0####.h####.com/preview/sp_images/2018/zongyi/323564/4457296/20180709091...
- 0####.h####.com/preview/sp_images/2019/3/2/zongyi/327491/5247462/2019030...
- 1####.h####.com/preview/cms_icon/2019/1/12/01/20190112142330405.jpg_130x...
- 1####.h####.com/preview/cms_icon/2019/1/6/01/20190106123235829.jpg_130x1...
- 1####.h####.com/preview/cms_icon/2019/1/6/01/20190106123329836.jpg_130x1...
- 1####.h####.com/preview/cms_icon/2019/2/13/02/20190213095329269.jpg_130x...
- 1####.h####.com/preview/cms_icon/2019/2/27/02/20190227102322828.png_366x...
- 1####.h####.com/preview/cms_icon/2019/2/27/02/20190227104341799.png_366x...
- 1####.h####.com/preview/cms_icon/2019/2/28/02/20190228192517126.jpg_750x...
- 1####.h####.com/preview/cms_icon/2019/3/1/03/20190301172918955.jpg_750x3...
- 1####.h####.com/preview/cms_icon/2019/3/2/03/20190302194853489.jpg_366x2...
- 1####.h####.com/preview/cms_icon/2019/3/2/03/20190302225157781.jpg_366x2...
- 1####.h####.com/preview/cms_icon/2019/3/2/03/20190302230352402.jpg_366x2...
- 1####.h####.com/preview/sp_images/2017/zongyi/310102/3888013/20170402202...
- 1####.h####.com/preview/sp_images/2018/11/16/zongyi/326363/4736291/20181...
- 1####.h####.com/preview/sp_images/2018/12/25/dianshiju/323323/4863265/20...
- 1####.h####.com/preview/sp_images/2018/zongyi/323564/4356679/20180417231...
- 1####.h####.com/preview/sp_images/2018/zongyi/325275/4688619/20181102133...
- 1####.h####.com/preview/sp_images/2019/3/2/zongyi/327491/5247449/2019030...
- 1####.h####.com/preview/sp_images/2019/3/2/zongyi/327491/5247452/2019030...
- 1####.h####.com/preview/sp_images/2019/3/2/zongyi/327491/5247456/2019030...
- ap####.v0.m####.com/buffer.php?td=####&net=####&istry=####&aver=####&tim...
- ap####.v0.m####.com/hb.php?ht=####&net=####&istry=####&aver=####&time=##...
- ap####.v0.m####.com/pv.php?nt=####&cpid=####&md=####&tst=####&gps=####&s...
- ap####.v0.m####.com/pv.php?nt=####&ftl=####&cpid=####&md=####&tst=####&g...
- com####.m####.com/video_comment/getcount?type=####&subject_id=####
- cou####.pe####.m####.com/message/poll?uid=####&osVersion=####&did=####&m...
- d####.t####.m####.com/vod.do?arange=####&fid=####&gsid=####&pm=####&svri...
- d####.t####.m####.com/vod.do?arange=####&fid=####&gsid=####&pm=####&ver=...
- d####.t####.m####.com/vod.do?fid=####&gsid=####&pm=####&svrip=####&ver=#...
- d####.t####.m####.com/vod.do?fid=####&gsid=####&pm=####&ver=####&chk=####
- e####.h####.com/1/ava1_QPMWgSqCTfjOSf7ctNPlvrGgZvpkJaR9.jpg
- g####.hun####.com/mobile/distribute.do?deviceid=####
- hun####.m.cn.####.com/x/k=2111269&p=7Lk5y&dx=0&rt=2&ns=95.211.190.198&ni...
- imgal####.res.m####.com/mediafiles/wiad_creative/1008/15506498742532.png
- imgal####.res.m####.com/mediafiles/wiad_creative/1008/15508350931413.jpg
- imgal####.res.m####.com/mediafiles/wiad_creative/1024/15508221975236.jpg
- imgal####.res.m####.com/mediafiles/wiad_creative/458/15512634053874.jpg
- log.da.hun####.com/info.php?f=####&ex=####&e=####&b=####&c=####&mod=####...
- log.da.hun####.com/info.php?f=-1&ex=&e=3.400601.300600&b=1&c=1&mod=<Syst...
- log.rc.hun####.com/rpt?region=####&mod=####&did=####&ver=####&net=####&c...
- mob.bz.m####.com/odin/c1/channel/list?uid=####&osVersion=####&mac=####&o...
- o####.ac####.api.####.com/artist/getRecommendCollectArtist?uid=####&osVe...
- o####.ar####.api.####.com/artist/getArtistListByIds?artistIds=####&type=...
- o####.ar####.api.####.com/artist/getArtistListByIds?uid=####&type=####&t...
- pl####.log.hun####.com/ad.gif?os=####&app=####&d=####&error=####&cache=#...
- pl####.log.hun####.com/playerQuality.gif?first_frame_time=####&seeking_t...
- qin####.com.www.####.com/tdata_EDT369
- s5.hun####.com/channel/live?uid=####&osVersion=####&ticket=####&appVersi...
- s5.hun####.com/mobile/like?did=####&uid=####&vid=####&c=####
- s5.hun####.com/mobile/rank?c=####
- s5.hun####.com/mobile/rank?uid=####&osVersion=####&c=####&mac=####&osTyp...
- s5.hun####.com/mobile/uip?uid=####&osVersion=####&ticket=####&appVersion...
- s5.hun####.com/mobile/user?uid=####&c=####&mac=####
- s5.hun####.com/recommend?uid=####&platform=####&osVersion=####&mac=####&...
- s5.hun####.com/user/getActivity?uid=####&osVersion=####&ticket=####&appV...
- s5.hun####.com/user/payConfig?uid=####&osVersion=####&ticket=####&appVer...
- s5.hun####.com/v1/config/play?uid=####&osVersion=####&ticket=####&appVer...
- s5.hun####.com/v5/listconfig?uid=####&platform=####&osVersion=####&mac=#...
- s5.hun####.com/v6/search/recommend?uid=####&osVersion=####&ticket=####&a...
- s5.hun####.com/v7/playlist/list?clipId=####&abroad=####
- s5.hun####.com/v7/video/getSource?uid=####&osVersion=####&mac=####&osTyp...
- s5.hun####.com/v8/video/info?uid=####&osVersion=####&mac=####&osType=###...
- s5.hun####.com/v8/video/list?uid=####&appVersion=####&ticket=####&fstlvl...
- s5.hun####.com/v8/video/relative?uid=####&appVersion=####&ticket=####&fs...
- st.bz.m####.com/odin/c1/channel/index?uid=####&osVersion=####&mac=####&o...
- t####.c####.q####.####.com/tdata_AXX896
- t####.c####.q####.####.com/tdata_BAI450
- t####.c####.q####.####.com/tdata_Fus136
- ti####.c####.l####.####.com/config/bj-bjv6.conf
- ti####.c####.l####.####.com/config/hz-bjv6.conf
- use####.api.max.####.com/person57ea2e2fa188a.jpg
- use####.api.max.####.com/person57fb6062d84a5.png
- use####.api.max.####.com/person585bbb1364394.jpg
- use####.api.max.####.com/person5ad6eea479eeb.png
- use####.api.max.####.com/person5ad6eea479eeb.png@1wh_1e_1c_0o_0l_130h_13...
- use####.api.max.####.com/person5b1b72e5b9d13.jpg@1wh_1e_1c_0o_0l_130h_13...
- use####.api.max.####.com/person5b726762e934a.jpg
- use####.api.max.####.com/person5c22237087396.jpg
- use####.api.max.####.com/person5c2f11c888308.jpg
- use####.api.max.####.com/preview/channel_images/20180126144432796.jpg_73...
- use####.api.max.####.com/preview/channel_images/20190110115242539.jpg_73...
- use####.api.max.####.com/preview/channel_images/20190220103623352.jpg_36...
- use####.api.max.####.com/preview/cms_icon/2019/2/26/02/20190226093308713...
- use####.api.max.####.com/preview/cms_icon/2019/3/1/03/20190301112502271....
- use####.api.max.####.com/preview/cms_icon/2019/3/2/03/20190302195503662....
- use####.api.max.####.com/preview/cms_icon/2019/3/2/03/20190302220825743....
- use####.api.max.####.com/preview/cms_icon/2019/3/2/03/20190302225821495....
- use####.api.max.####.com/preview/cms_icon/2019/3/2/03/20190302234637671....
- use####.api.max.####.com/preview/cms_icon/2019/3/3/03/20190303233307143....
- use####.api.max.####.com/preview/sp_images/2016/zongyi/101575/3750550/20...
- use####.api.max.####.com/preview/sp_images/2017/zongyi/308703/4152184/20...
- use####.api.max.####.com/preview/sp_images/2017/zongyi/310102/3783430/20...
- use####.api.max.####.com/preview/sp_images/2017/zongyi/310102/3893897/20...
- use####.api.max.####.com/preview/sp_images/2018/12/11/zongyi/327378/4807...
- use####.api.max.####.com/preview/sp_images/2018/12/21/zongyi/326363/4843...
- use####.api.max.####.com/preview/sp_images/2018/zongyi/320515/4653940/20...
- use####.api.max.####.com/preview/sp_images/2018/zongyi/323564/4441907/20...
- use####.api.max.####.com/preview/sp_images/2018/zongyi/323564/4447518/20...
- use####.api.max.####.com/preview/sp_images/2018/zongyi/323564/4455265/20...
- use####.api.max.####.com/preview/sp_images/2019/3/2/zongyi/327224/524749...
- use####.api.max.####.com/preview/sp_images/2019/3/2/zongyi/327491/524745...
- use####.api.max.####.com/preview/sp_images/2019/3/2/zongyi/327491/524746...
- use####.api.max.####.com/preview/sp_images/2019/3/2/zongyi/327491/524762...
- use####.api.max.####.com/preview/sp_images/2019/3/2/zongyi/327491/524770...
- v2.log.hun####.com/info.php?f=-1&ex=&e=3.400601.300600&b=1&c=1&mod=<Syst...
- v2.log.hun####.com/info.php?f=0&ex=&e=&b=1&c=1&mod=<System Property>&a=0...
- v2.log.hun####.com/info.php?f=0&ex=&e=105000&b=1&c=1&mod=<System Propert...
- vc.m####.com/v2/dynamicinfo?uid=####&osVersion=####&mac=####&pid=####&os...
- vhun####.adma####.com.cn/i/a122297,b3222326,c1370,i0,m202,8a2,8b1,f95.21...
- vhun####.adma####.com.cn/i/a123033,b3191084,c1370,i0,m202,8a2,8b1,h,0a0,...
- y.da.hun####.com/app/impression?_serverip=####&adid=####&adtotal=####&ap...
- y.da.hun####.com/err?_serverip=10.43.6.233&adid=CACFA3961E931923CDBC317A...
Запросы HTTP POST:
- a####.u####.com/app_logs
- c-h####.g####.com/api.php?format=####&t=####
- log.da.hun####.com/v1/t
- log.v2.hun####.com/dispatcher.do
- m####.api.m####.com/mpns/parseLog
- mo####.log.hun####.com/data.cgi
- mo####.log.hun####.com/dispatcher.do
- o####.ac####.api.####.com/global/config
- o####.ar####.api.####.com/artist/getArtistListByIds
- res####.a####.com/v3/log/init
- sdk-ope####.g####.com/api.php?format=####&t=####
- sdk-ope####.g####.com/api.php?format=####&t=####&d=####&k=####
- vc.m####.com/v2/watch
- www.qchann####.cn/center/adj
- www.qchann####.cn/center/adj?appkey=####
- x.da.hun####.com/json/app/boot
- x.da.hun####.com/m/page
- x.da.hun####.com/video/player
- x.da.m####.com/m/page
Изменения в файловой системе:
Создает следующие файлы:
- /data/data/####/-613446676
- /data/data/####/.imprint
- /data/data/####/028831535f8d78414462442a36b2bd1b8b5e8c096b6a436....0.tmp
- /data/data/####/07e40c6f5dfdef946816b95fb935aa3d3199031dbc7cedc....0.tmp
- /data/data/####/0a7683c3f2eb7261e8e7626883bf34ef5f6796e6077e76e....0.tmp
- /data/data/####/0c1d5711c8a573a539f8de5f853ace28df088fc585ca059....0.tmp
- /data/data/####/1172516e70003030926c10fbb463cf0955ee12f11cc5681....0.tmp
- /data/data/####/12308023793cd030dfae97e918c0e1a98295e50d15d1eef....0.tmp
- /data/data/####/12aa79ae6c5d93b1e8659f4d3c548503
- /data/data/####/1448088308322abc2893065bbd8491d1568694e440fa828....0.tmp
- /data/data/####/14febfed31b0d573d441b9da0bf6d02fb32e1ccfdaeacdf....0.tmp
- /data/data/####/15e4c9e11457450dea09c51934556ea21535acf8111ef36....0.tmp
- /data/data/####/16cc43660839b8b9d46fcda954851c0bad4fad5f0fa11a0....0.tmp
- /data/data/####/1703720991
- /data/data/####/18cc52ebe569407108b1187a4046c3ef43066d35cbf1d33....0.tmp
- /data/data/####/18d3d83b3bef2deb4fd1d7c18305cbd280d5132318cbc1c....0.tmp
- /data/data/####/19a23cecfd57dd4926960cc35ca553bad6a1ed965cc5f76....0.tmp
- /data/data/####/2007dc0e49d5542dcbf61f7c9a25797d6221e8abf278dcc....0.tmp
- /data/data/####/2068cb5908d333a42a9a19e2bb1c188233eaf087863f651....0.tmp
- /data/data/####/20bcc1aa2065c308fcb01d409aeb96cb1d897bcce7a722d....0.tmp
- /data/data/####/257306020
- /data/data/####/257306024
- /data/data/####/257306028
- /data/data/####/29d87167250bb33abc80c826e34d6c43d519b3a47830b4d....0.tmp
- /data/data/####/3857f7119d707b24fe3d52150e5b3d110519299441378bc....0.tmp
- /data/data/####/3e304289cd3b71103d37ee2fb132cfb0037512e71267254....0.tmp
- /data/data/####/3fd160ca349e6fed8f7258cce7d9494cbfacdde9e89f2f4....0.tmp
- /data/data/####/40e43721a2bf5bb5a057bb87785e578d
- /data/data/####/43471d34796dfedf8579938530103321
- /data/data/####/4f58ab7cb92d6fe89a7fb6be13cf097637d6e981c28b9ba....0.tmp
- /data/data/####/51998ecddb483c544d9ef8a21eb8b9f812a1346c6c02cf9....0.tmp
- /data/data/####/5a5b277776b3e731fbb7d727c492cd1be7476baf241c6ac....0.tmp
- /data/data/####/5a70972f4458a4d2f332aebe9bef4fcf797e71e72cae6ff....0.tmp
- /data/data/####/5c39c7fb9a8adc3f7d9ae46f6d540fffe4366e95b1553c8....0.tmp
- /data/data/####/5df75543c503
- /data/data/####/5e60e206d70f8674d1ecbf970cfa0499
- /data/data/####/611eed57e5717d2e2c0e6a57aa34483d2dd49868617de0a....0.tmp
- /data/data/####/613da8d63b13cb30c3c7636cee3fe7c11f48330f1596ddd....0.tmp
- /data/data/####/614108960
- /data/data/####/6164488808ecdfe1bb669cf1488d6e4f
- /data/data/####/649c4dc83fbcf369f6ad192720bb8c104244f0fa28f3e76....0.tmp
- /data/data/####/6550879cfdd8da6688a3c1e978310a3c
- /data/data/####/6ddd7ff40667bdab3ab6b2773ed1ccbc050ab4342e5a16f....0.tmp
- /data/data/####/6fadb275c484b591c9509d5f17bf80c928f5d827657a97e....0.tmp
- /data/data/####/7115a56b634554a215dea44ee35ec98cbb6dbff42b37696....0.tmp
- /data/data/####/71cd96f8cef2df050db66645fb907bfd7191db22bfc569c....0.tmp
- /data/data/####/72b327a8d40e4ba6f85faf9cbdc96c4f234808dd0681343....0.tmp
- /data/data/####/72b327a8d40e4ba6f85faf9cbdc96c4f234808dd0681343...0bc8.0
- /data/data/####/72f46b04841689c1c93cbf538f1ed5994075387a4b2400d....0.tmp
- /data/data/####/73ffd793a52c5d027c6251f65c4ec5e25cbeea8b4a767c0....0.tmp
- /data/data/####/744bf89bf042410f9fb403b1f98ffa428d465268ab45782....0.tmp
- /data/data/####/79366657e29cdd536e8a5963d629aba913f653c19aedaf4....0.tmp
- /data/data/####/7ca20808d2870c46d88366654ca001ead5ac22aeb50416c....0.tmp
- /data/data/####/7caa7a9272db09791b998e99ea5d3051c080a72841983b4....0.tmp
- /data/data/####/8311f9aee8bc5eb234174293a06acd23502e850b15baf65....0.tmp
- /data/data/####/86a78705eea62c3cbf53f643132c60f335e38df6bbcd0c9...a7d6.0
- /data/data/####/8709dd38e8955b4b4083b955af8642b25de2545812b11cf....0.tmp
- /data/data/####/8855d789c7a58356284a33c25b00c8ed
- /data/data/####/88eaa927ce9d438fd4f6612e596215ceb239d9b7d263721....0.tmp
- /data/data/####/8a044ede603042a4c7908e7152bdb90121e821661cbc39c....0.tmp
- /data/data/####/933978904
- /data/data/####/945c99a453989aac13406f5a05d96d464bbc040eca37815....0.tmp
- /data/data/####/99e9b46efc3e5fd5ab77bb3ea913aeffb4c4ecc5dd38b9c....0.tmp
- /data/data/####/9b1288c6956c07963ed5c9aa3ef503cc713c52d43ae2a86....0.tmp
- /data/data/####/9c2d7b976c66b449900cda631eafbd282a6c0a5cac393f7....0.tmp
- /data/data/####/ImgoPad-journal
- /data/data/####/LOG_CACHE.xml
- /data/data/####/MGTVCommon.xml
- /data/data/####/MGTVCommon.xml.bak
- /data/data/####/MV3Plugin.ini
- /data/data/####/MV3Plugin_Default.ini
- /data/data/####/QT.xml
- /data/data/####/a3f6ae7b3fa8714caf61a38634a783b7c5ceba81b2de078....0.tmp
- /data/data/####/a4b9912baf5dda3c18d45e3036bd82a5c53555257a792b9....0.tmp
- /data/data/####/a658e48a8d232d8f9d801deb531b4510947d23a006742cd....0.tmp
- /data/data/####/a8db3190d548491214f1165c0e08385772abf2047bd56af....0.tmp
- /data/data/####/ac5d55b66a18a66bea42dd0385ebef667927c8e10f15746....0.tmp
- /data/data/####/af2c272be061b6b8bedc721512c8f4701d6a47289fc54cf....0.tmp
- /data/data/####/af8463c3d84a73c89041e232e9bc5b5ee9bc3c14246a843....0.tmp
- /data/data/####/arch.xml
- /data/data/####/b02e2f9f2067ad2ba8b953ebf72a396ff51f4c7b3ede175....0.tmp
- /data/data/####/b0b938f4b78620e5f7d0f47af7f7a174ba2379af55455ab....0.tmp
- /data/data/####/b1d13ddac40cbb20c4def22dab47da0c
- /data/data/####/bd35083a5a398d01839ed4812b25e91fc2246e7e3448b48....0.tmp
- /data/data/####/c08dffd6d9ea8f9ad4e65046b4204fd370e845ff93b050d....0.tmp
- /data/data/####/c0bf6ddb2888ca36126f0aea018d0efd4011ce28fa07387....0.tmp
- /data/data/####/c327b6fc2737484c2e67105c447000780e6470540d7800a....0.tmp
- /data/data/####/c85ecae9e6930d6be43dc16b184537ec2122cc7923db8ad....0.tmp
- /data/data/####/c9ead0bc580508e4c94b9c1a6f41b446
- /data/data/####/cdb5353e6247be04c3f1a59daf6e4d12f18478aa10859ff....0.tmp
- /data/data/####/cee5254715e3fe3be9de4ae4d66c287542ff0069f6c32a1....0.tmp
- /data/data/####/cn.com.mma.mobile.tracking.normal.xml
- /data/data/####/cn.com.mma.mobile.tracking.other.xml
- /data/data/####/d0d5980df46cb81f502187f17e6270023ca73fc41983e23....0.tmp
- /data/data/####/d54fba33299e341337c067c26b150cef2d4852144a0c2eb....0.tmp
- /data/data/####/d591d6d80012a95951b84df071c65b00ed9c2e5d0a09b97....0.tmp
- /data/data/####/d6214171635b0ac0bb889fe88930f18eb70bb95bec43c08....0.tmp
- /data/data/####/d6273d897d8745c76b33eb7b16effa814ba6d4920bf07f0....0.tmp
- /data/data/####/d7531218139e568a696ad616f0afb00b7c4c3b838f1bd4c....0.tmp
- /data/data/####/d7f54ce08e7b6b44c65e6056862595b2f88de256fc6f7ee....0.tmp
- /data/data/####/d837ff66414b240467e85504eddd418834dac8b1c0771bb....0.tmp
- /data/data/####/d8741e8aff896ff86ad68310d73028098d23e183a00b24e....0.tmp
- /data/data/####/e35843786b761d8514e435f47e4e1fe67d1a3750b385283....0.tmp
- /data/data/####/e7b5c74b248d2bb50688221386d599e6a0c3494e6bd775c....0.tmp
- /data/data/####/ec06cfa6bc0abbe04ae74f1e1bfbae3748cee396ceaac1b....0.tmp
- /data/data/####/ed4017c9ccc641e99eb9320c9532e1a408fdbbfdc6ef575....0.tmp
- /data/data/####/ee169f8d9e19d04c55d9aff740922ae6209b3d738686a44....0.tmp
- /data/data/####/exchangeIdentity.json
- /data/data/####/f367fce9225b7d8a0cf7076a9fb0f02ffa03fc64e1326c1....0.tmp
- /data/data/####/f4b4a3d0d4ae031234524bb360bc6d90e20f92640f28311....0.tmp
- /data/data/####/fdf1919d2c6fb361ebd9adb98849b9ef19d47e729f16cf7....0.tmp
- /data/data/####/gdaemon_20161017
- /data/data/####/getui_sp.xml
- /data/data/####/gkt-journal
- /data/data/####/gx_sp.xml
- /data/data/####/hmt_agent_commonutill_com.luhuo.movie.free.xml
- /data/data/####/hmt_agent_commonutill_device_id.xml
- /data/data/####/hmt_agent_online_setting_com.luhuo.movie.free.xml
- /data/data/####/hmt_analytics
- /data/data/####/hmt_analytics-journal
- /data/data/####/hmt_init_savetime.xml
- /data/data/####/hmt_irsuid.xml
- /data/data/####/hmt_session_id.xml
- /data/data/####/hmt_session_id_savetime.xml
- /data/data/####/hmt_session_id_savetime.xml.bak
- /data/data/####/hmt_session_id_savetime.xml.bak (deleted)
- /data/data/####/init.pid
- /data/data/####/init_c1.pid
- /data/data/####/journal.tmp
- /data/data/####/last_know_location.xml
- /data/data/####/libjiagu-572316650.so
- /data/data/####/multidex.version.xml
- /data/data/####/openudid_prefs.xml
- /data/data/####/playinfo.db-journal
- /data/data/####/push.pid
- /data/data/####/pushext.db-journal
- /data/data/####/pushg.db-journal
- /data/data/####/pushsdk.db-journal
- /data/data/####/qtsession.xml
- /data/data/####/root.db-journal
- /data/data/####/run.pid
- /data/data/####/tdata_AXX896
- /data/data/####/tdata_AXX896.jar
- /data/data/####/tdata_BAI450
- /data/data/####/tdata_BAI450.jar
- /data/data/####/tdata_Fus136
- /data/data/####/tdata_Fus136.jar
- /data/data/####/umeng_general_config.xml
- /data/data/####/umeng_general_config.xml.bak
- /data/data/####/umeng_general_config.xml.bak (deleted)
- /data/data/####/umeng_it.cache
- /data/data/####/webview.db-journal
- /data/media/####/.nomedia
- /data/media/####/0af8945e50d4ad9cf1bc20b89d552b6e
- /data/media/####/1_log.txt
- /data/media/####/2d080f79e8cc52e89ea8f2969903c3e4
- /data/media/####/309231bd88f66210ac841fd06b9434f0
- /data/media/####/4f24978fdf99ebc6f5bc3afecc8e31f3
- /data/media/####/7c14551ed065db8d34026b8b0e97a9b6
- /data/media/####/97f9480e2b380a01c48ef06f688a2ec2
- /data/media/####/AN.csv-20190303230728
- /data/media/####/APITimeMark.txt
- /data/media/####/TruthInfo.csv-1551654450196
- /data/media/####/UA.csv-20190303230730
- /data/media/####/UnicomTrafficFree.log
- /data/media/####/apge.csv-20190303230740
- /data/media/####/apge.csv-20190303230746
- /data/media/####/apge.csv-20190303230800
- /data/media/####/app.db
- /data/media/####/com.getui.sdk.deviceId.db
- /data/media/####/com.igexin.sdk.deviceId.db
- /data/media/####/com.luhuo.movie.free.bin
- /data/media/####/com.luhuo.movie.free.db
- /data/media/####/e9fed7286878f31b46edb91e737ee6e1
- /data/media/####/gkt-journal
- /data/media/####/gktper
- /data/media/####/journal.tmp
- /data/media/####/qt.csv.1551654447806.txt
- /data/media/####/tdata_AXX896
- /data/media/####/tdata_BAI450
- /data/media/####/tdata_Fus136
- /data/media/####/test.log
- /data/media/####/uuid
Другие:
Запускает следующие shell-скрипты:
- <Package Folder>/files/gdaemon_20161017 0 <Package>/com.hunantv.imgo.service.GetuiPushService 24976 300 0
- cat /proc/cpuinfo
- cat /sys/class/net/wlan0/address
- chmod 700 <Package Folder>/files/gdaemon_20161017
- mount
Загружает динамические библиотеки:
- CdnAuth
- ImgoFfmpeg
- ImgoHelp
- ImgoMediaPlayer_V3.0.3
- MMANDKSignature
- getuiext2
- libjiagu-572316650
Использует следующие алгоритмы для шифрования данных:
- AES-CFB-NoPadding
- AES-ECB-PKCS5Padding
- DES-CBC-PKCS5Padding
- RSA-ECB-PKCS1Padding
- RSA-NONE-OAEPWithSHA1AndMGF1Padding
Использует следующие алгоритмы для расшифровки данных:
- AES-ECB-PKCS5Padding
- DES-CBC-PKCS5Padding
Использует специальную библиотеку для скрытия исполняемого байт-кода.
Получает информацию о местоположении.
Получает информацию о сети.
Получает информацию о телефоне (номер, IMEI и т. д.).
Получает информацию об установленных приложениях.
Получает информацию о запущенных приложениях.
Добавляет задания в системный планировщик.
Отрисовывает собственные окна поверх других приложений.
